---
id: CVE-2026-72757
title: Routinator HTTP server becomes unavailable with many unclosed connections
summary: >-
  Routinator runs out of open connections on the HTTP server when many
  connections are opened but never closed, leaving the HTTP server unavailable.
  This condition can be triggered maliciously by an attacker by opening a large
  number of co…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-755
vendor: NLnet Labs
product: Routinator
affected:
  - Routinator (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-26T17:46:37.033179Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T17:57:33.452Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72757'
references:
  - url: 'https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-72756.txt'
tags:
  - cve.org
ingestedAt: '2026-10-26T17:33:33.057Z'
epss: 0.00359
epssPercentile: 0.29492
---

## Overview

Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.

This only affects users that make their HTTP or RTR server available to untrusted networks.

## Affected

- `Routinator (all versions)`

## Remediation

This issue is fixed in 0.15.3 and all later versions.